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Amendments to the Specification 

Please replace the paragraph at ^pafge^ 26^line"l7 - pa^e^28, jme 1 5 with the 
following amended paragraph: 

In Figure 2. the processing starts at step 201 . It is presumed that a projective 
coordinate component Xo of the x-coordinate of a given point R and a scalar value m 
are inputted and that a projective coordinate component Xm of the x-coordinate of a 
point corresponding to m-multiple of R is to be outputted. On this assumption, the 
scalar value m and the projective coordinate component Xo of the x-coordinate are 
inputted (step 202). In the succeeding steps 203 to 205, data stirring is performed 
by multiplying the individual projective coordinates by the random number. More 
specifically, the random number k is generated in the step 203, whereon k^Xo is 
arithmetically determined by multiplying the projective coordinate component Xo by 
the random number k and assigned to Xi in the step 204 while the random number k 
itself is assigned to Zi in the step 205. In succeeding steps 206 to 208 and 301 , 
preparation is made for the scalar multiplication. In more concrete, [Xi, Zi] is 
assigned to [X4, Z4] in the step 206, being followed by the step 206 where [X1.Z1] is 
inputted to the doubling process (illustrated in Fig. 5), the output of which is then 
assigned to [X2. Z2] in the step 207. Further, in a step 208, the scalar value m is 
transformed to a binary bit string hjhj.i ... ho, where the most significant bit hi is "1" 
and thus "1" is assigned to ] in a step 301 shown in Fig. 3. Through processing 
steps 302 to 309 (see Fig. 3), the addition method and the doubling method are 
controlled in dependence on whether one bit of the scalar value m is "0" or "1" to 
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thereby realize the scalar multiplication. More specifically, "i-1" is assigned to i in the 
step 302, which is followed by the step 303 where [Xi. Zi]. [X2. Z2] and [X4. Z4] are 
inputted to the addition process (illustrated in Fig. 4), the output of which is assigned 
to [X3. Z3] in the step 303. At this juncture, when hi == 0 (i.e.. when the step 304 
results in affirmation "Yes"), the processing proceeds to the step 305 while it 
proceeds to the step 307 when hi == 1 . i.e., when the decision step 304 results in 
negation "No". In the step 305, [Xi. Z^] is inputted to the doubling arithmetic or 
process (Fig. 5), the output from which is assigned to [Xi,Zi], In the step 306, [X3, 
Z3] is assigned to [X2. Z2]. whereon the processing proceeds to the step 309. On the 
other hand, when the decision step 304 results in "No", [X2.Z2] is inputted to the 
doubling arithmetic or process illustrated in Fig. 5, the output of which is assigned to 
[X2, Z2] (step 307). In the step 308, [X3, Z3] is assigned to [Xi, Zi], whereupon the 
processing proceeds to the step 309. In the case where i > 0, i.e., the step 309 
results in "Yes", when the step 302 is resumed. If otherwise, i.e., when the decision 
step 309 results in "No", the processing proceeds to a step 310. Subsequently, the 
projective coordinates are transformed to the x-coordinate of the (x, y) coordinate 
system. Finally Xi/(Zi)^ is assigned to the projective coordinate component Xm (step 
310) to be ultimately outputted (step 31 1 ). The processing ends at step 312. 

Please replace the paragraph at pa^e 30, \\r\e^ - pa^e 31 , Jirte^ 1 0 with the 
following amended paragraph: 



Figure 4 is a flow chart for illustrating the addition method according to the 
first embodiment of the present invention. Processing starts at step 401 . The 
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projective coordinates [Xi, Z^], [X2.Z2] and [Xa.Za] are inputted, whereby coordinates 
[X3.Z3] or a point at infinity is outputted. Thus, the projective coordinates [X^Z^], [X2. 
Z2] and [X4, Z4] are inputted in a step 402. Through processings in steps 403 to 407, 
Xi(Z2)^ + X2{Z^f is determined for making decision whether or not the result of the 
addition arithmetic represents the point at infinity. Interim results Si, S2 and B 
provide preparation for the realization of the expressions (2) and (3) mentioned 
above. More specifically, X^{Z2f is assigned to Si in the step 403 and X2{Z^f is 
assigned to S2 in the step 404 whereupon S^ + S2 is assigned to B in the step 405. 
When B == 0 in the step 406 (i.e., when the decision step 406 results in "Yes"), the 
processing proceeds to the step 407. If otherwise (I.e.. when the decision in the step 
406 results in "No"), the processing proceeds to the step 408. In the step 407, the 
point at Infinity is outputted, whereon the processing comes to an end (step 413). 
Through the processing steps 408 to 41 1 executed when the decision step 406 
results in "No", the coordinates [X3.Z3] are determined in accordance with the 
expressions (2) and (3) mentioned hereinbefore. In more concrete, Z4B is assigned 
to Z3 in the step 408 and (Z4)^SiS2 is assigned to S in the step 408 with X4B^ being 
assigned to M in the step 410, whereupon M + S is assigned to X3 in the step 41 1 , 
and [X3, Z3] is outputted in the step 412. Through the procedure described above, 
the addition arithmetic can be realized sextuple multiplications of the mutually 
different variables. In other words, X3 can be arithmetically determined from Xi, X2 
and X4 at a high speed. The process ends at step 413. 



U.S. Application No. 09/468,948 
Please replace the paragraph at g^ge 31 . \\vie 27 - f^age 32, l^r(e28 with the 

following amended pa ragraph^ ■ ■ 

Figure 5 is as flow chart a flowchart for illustrating the doubling method 
according to the first embodiment of the present invention. Referring to the figure. 
step 501 denotes start. i t-It is presumed that Q = [Xi, Zi] and b are inputted, 
whereby 2Q = [X2. Z2] or alternatively the point at infinity is to be outputted. In a step 
502, Xi and Zi are inputted. In the succeeding steps 503 and 504, decision is made 
whether or not Xi == 0 or Zi == 0 is valid in order to make decision as to whether the 
doubling arithmetic results in the point at infinity. Namely, when Xi == 0 or Z^ == 0 in 
the step 503 (i.e., when the decision step 503 results in "Yes"), the processing step 
proceeds to the step 504. If otherwise (i.e., when the decision step 503 results in 
"No"), the processing proceeds to a step 505. In the step 504, the point at infinity is 
outputted. In the succeeding steps 505 to 507, the coordinates [X2, Z2] are 
determined in accordance with expressions (4) and (5) mentioned previously. More 
specifically, in the step 505, is assigned to S. In the step 506. XiS is assigned to 
Z2. In the step 507, X/ + b(S)'^ is assigned to X2 (step 507). In the step 508. the 
coordinates [X2, Z2] are outputted. Through the procedure described above, the 
addition arithmetic can be realized by executing twice the multiplication of mutually 
different variables. Accordingly, in the scalar multiplication method, the addition 
arithmetic can be realized by executing (6 + 2 = 8)- times the multiplication of 
mutually different variables per bit of the scalar value d. In other words, the 
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^ projective coordinate X3 can be arithmetically determined very speedily from Xi, X2 
and X4. The process ends at step 509. 

Please replace the paragraph atja^ge 34, ]\iie28 - gB^36^JAr(e22 with the 
following amended paragraph: 



r 



Figures 6 and 7 in combination illustrate in a flow chart, a processing 
procedure for the scalar multiplication method according to the second embodiment 
of the present invention. The process begins at step 601 . It is presumed that a 
projective coordinate component Xo of the x-coordinate of a given point R and a 
scalar value m are inputted for thereby outputting a projective coordinate component 
Xm of the x-coordinate of a point corresponding to the m-multiplication or m-tuple of 
R. To this end, the scalar value m and the projective coordinate component Xo of 
the x-coordinate are inputted in the step 602. In the succeeding steps 603 and 604, 
transformation of Xo to the projective coordinate is performed. More specifically, in 
the step 603, Xo is assigned to Xi. In the step 604, "1" is assigned to Zi. In the 
processing steps 605 to 607, preparation is made for the scalar multiplication. In 
more concrete, coordinates [Xi, Z^] are assigned to [X4. Z4] in the step 605 to 
thereby allow [Xi, Zi] to be inputted to the doubling arithmetic (Fig. 5), the output of 
which is assigned to [X2, Z2] in the step 606. In the step 607, hjhM ... ho are set as 
the binary bit string representing the scalar value m, in which the most significant bit 
hi is "1", and thus "1" is assigned to ] in a step 701 shown in Fig. 7. In the 
succeeding processing steps 702 to 709, the addition method and the doubling 
method are controlled in dependence on whether one bit of the scalar value m is "0" 
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or "1", to thereby determine the scalar multiplication. More specifically, in the step 
702, "i-1" is assigned to i while in the step 703, [Xi, Zi]. [X2. Z2] and Xo are inputted 
to the addition method (Fig. 8), the output of which is assigned to [X3, Z3]. When hi 
== 0 (i.e., when the decision step 704 results in affirmation "Yes"), the processing 
proceeds to the step 707 when hi == 1 . i.e., when the decision step 704 results in 
negation "No". In the step 705, [Xi, Zi] is inputted to the doubling method (Fig. 5), 
the output from which is assigned to [Xi, Zi]. In the succeeding step 706, [X3, Z3] is 
assigned to [X2, Z2], whereupon the processing proceeds to the step 709. On the 
other hand, in the step 707, [X2, Z2] is inputted to the doubling method (Fig. 5). the 
output of which is assigned to [X2, Z2]. In the succeeding step 708, [X3, Z3] is 
assigned to [Xi, Z^], whereupon the processing proceeds to the decision step 709. 
In case the decision step 709 results in that i > 0 (i.e., when the step 709 results in 
"Yes"), the step 702 is resumed. On the other hand when i < 0, i.e.. when the 
decision step results in "No", the processing proceeds to step 710 where X^/{Z^f is 
assigned to the projective coordinate component Xm to be ultimately outputted (step 
711) . The process ends at step 712. 



Please replace the paragraph at pdge 36, jinel24 - pjage 37. Vme^ with the 
following amended paragraph: 



Figure 8 is a flow chart for illustrating the addition method according to the 
second embodiment of the invention. Step 801 denotes start. It is presumed that 
^ the projective coordinates [Xi. Zi],-[X2, Z2] and [X4. Z4] are inputted and that [X3, Z3] 
or the point at infinity is to be outputted. Thus, the projective coordinates [Xi, Z^], 



7 



U.S. Application No. 09/468.948 
[X2. Z2] and [X4. Z4] are inputted in a step 802. Through the processings in 
subsequent steps 803 to 807, X^{Z2f + X2{Z^f is computed for making decision 
whether or not the result of the addition represents the point at infinity. Interim 
results Si, S2 and B provide preparation for realization of the expressions (6) and (7) 
mentioned previously. More specifically, X^{Z2f is assigned to Si in the step 803. In 
the step 804, X2{Z^f is assigned to S a. in tho Sp. In the step 805, Si + S2 is 
assigned to B. When it is decided that B == 0 in the step 806 (i.e., when decision in 
the step 806 results in "Yes"), the processing proceeds to the step 807. If otherwise 
(i.e., when the decision in the step 806 results in "No in "No" ), the processing 
proceeds to the step 808. In the step 807, the point at infinity is outputted^ whereon 
the processing proceeds to the step 813. Through the processing steps 808 to 81 1 . 
the projective coordinates [X3, Z3] are determined in accordance with the 
expressions (6) and (7) mentioned hereinbefore. In more concrete, B is assigned to 
Z3 in the step 808. In the step 809, S1S2 is assigned to S. In the step 810, XaZz^ is 
assigned to M. In the step 81 1 , M + S is assigned to X3. Finally, in the step 812, [X3, 
Z3] is outputted. Step 813 denotes end. 

Please replace the paragraph at^p^ige 40, lineal 6 pa0e 42, Ipe^^ with the 
following amended paragraph: 

Figures 1 1 A and 1 1B are flow charts for illustrating the scalar multiplication 
method in which the Montgomery method is adopted according to the third 
embodiment of the present invention. Referring to the figures, Mhe process starts at 
step 1 101 . It is presumed that a projective coordinate component Xo of the x- 
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coordinate of a given point R and a scalar value m are inputted and that a projective 
coordinate component Xm of the x-coordinate of a point corresponding to m- 
multiplication of R is to be outputted. To this end, the scalar value m and the 
projective coordinate component Xo of the x-coordinate are inputted in the step 1 102 
shown in Fig. 1 1A. In the succeeding steps 1 103 to 1 105, data is stirred through 
multiplication of the individual coordinates in the projective coordinate system by the 
random number. More specifically, the random number k is generated in step 1 103, 
whereon kXo is determined by multiplying the projective component Xo of the x- 
coordinate by the random number k. and then kXo is assigned to Xi in the step 1 104 
while the random number k being assigned to Zi in the step 1 1 05. In succession, 
[Xi, Zi] is assigned to [X4, Z4] (step 1 106). Subsequently, [Xi, Zi] is inputted to the 
doubling method (i.e., Montgomery's doubling arithmetic), the output of which is 
assigned to [X2, Z2] (step 1 107). Further, the scalar value m is transformed to the 
binary bit string hjhi-i ... ho (step 1 108), where the most significant bit hi is "1". Thus 
"1 " is assigned to i in the step 1 1 09 shown in Fig. 1 1 B. In a succeeding step 1110, 
"i-1" is assigned to i, which is then followed by a step 1111 where [Xi, Zi], [X2, Z2] 
and [X4, Z4] are inputted to the addition method (Montgomery's addition arithmetic), 
the output of which is assigned to [X3, Z3] (step 1111). When hi == 0 in the step 
1112 (i.e., when the decision step 1112 results in affirmation "Yes), the processing 
proceeds to a step 1113 while it proceeds to a step 1115 when hi == 1 , i.e., when the 
decision step 1112 results in negation "No". In the step 1113 shown in Fig. 1 1B, [Xi, 
Zi] is inputted to the doubling method (Montgomery's doubling arithmetic), the output 
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from which is assigned to [Xi, Zi]. In the succeeding step 1 1 14, [X3, Z3] is assigned 
to [X2, Z2], whereon the processing proceeds to a step 1117. On the other hand, 
when the decision step 1112 results in "No", [X2, Z2] is inputted to the doubling 
nnethod (Montgomery's doubling arithmetic), the output of which is assigned to [X2. 
^ Z2] (step 1115). Further, [X3, Z3] Is assigned to [Xi , Zi] in the step 1116, whereupon 
the processing proceeds to a step 1117. In the case where i > 0, i.e., the step 1117 
results in "Yes", the step 1 1 10 is resumed. If otherwise, I.e., when the decision step 
1117 results in "No", the processing proceeds to a step 1118 where Xi/(Zi) is 
assigned to the projective coordinate component Xm to be ultimately outputted in the 
step 1119, whereupon the processing comes to an end (step 1 120). 
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Please replace the paragraph ati5age 43,Jirfe^26 -^ag^^, jiffel21 with the 



following amended paragraph: 



Figures 12A and 12B are flow charts for illustrating the scalar multiplication 
method according to the fourth embodiment of the present Invention. Referring to 
the figures, i ^the process starts at step 1201 . It is presumed that a projective 
coordinate component Xo of the x-coordlnate of a given point R and a scalar value m 
are inputted and that a projective component Xm of the x-coordinate of a point 
corresponding to m-multlplication of R (i.e., the point corresponding to the product of 
m and R) is to be outputted. On the presumption, the scalar value m and the 
projective coordinate component Xo of the x-coordinate are inputted In the step 1202 
shown in Fig. 12A. In the succeeding steps 1203 to 1205, data Is stirred through 
multiplication of the individual projective coordinates by the random number. More 
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specifically, the random number k is generated in the step 1203. whereon kXo is 
determined by multiplying the projective coordinate component Xo of the x- 
coordinate by the random number is, and then kXo is assigned to Xi in the step 1204 
while the random number k itself being assigned to Zi in the step 1205. In 
succession. [Xi. Zi] is assigned to [X4, Z4] (step 1206). Subsequently. [Xi. Zi] is 
inputted to the doubling arithmetic, the output of which is assigned to [X2. Z2] (step 
1207). Further, the scalar value m is transformed to the binary bit string hi hM ... ho 
(step 1208). where the most significant hi is "1". Thus. "1" is assigned to i in the step 

1209 shown in Fig. 12B. In a succeeding step 1210. "i - 1" is assigned toj. which is 
then followed by a stop 1011 step 1211 where [Xi. Zi]. [X2, Z2] and [X4. Z4] are 
inputted to the addition arithmetic, the output of which is assigned to [X3. Z3]. When 
hj == "0" in the step 1212 (i.e.. when he decision step 1212 results in affirmation 
"Yes"), the processing proceeds to a step 1213 while it proceeds to a step 1215 
when hj == "1". i.e.. when the decision step 1212 results in negation "No". In the 
step 1213 shown in Fig. 12B, [Xi, Z^] is inputted to the doubling arithmetic, the output 
from which is assigned to [Xi, Zi]. In the succeeding step 1214, [X3, Z3] is assigned 
to [X2, Z2]. whereon the processing proceeds to a step 1217. On the other hand, 
when the decision step 1212 results in "No", [X2, Z2] is inputted to the doubling 
arithmetic, the output of which is assigned to [X2, Z2] (step 1215). Further, [X3, Z3] is 
assigned to [Xi, Z^] in the step 1216. whereupon the processing proceeds to a step 
1217. In the case where i > 0, i.e., when the step 1217 results in "Yes", the step 

1210 is resumed. If otherwise, i.e., when the decision step 1217 results in "No", the 
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processing proceeds to a step 1218 where X^/{Z^) is assigned to the projective 
coordinate component Xm to be ultimately outputted in the step 1219. whereupon the 
processing comes to an end (step 1220). . 



Please replace the paragraph at.^ar^ge 47. |irfes^-22 with the following 
amended paragraph: 

Figure 13 is a flow chart for illustrating an addition method according to the 
fourth embodiment of the present invention. The process starts at step 1301 . It is 
assumed that projective coordinates [Xi, Zi], [X2, Z2] and [X4, Z4] are inputted, 
whereby [X3, Z3] or the point at infinity is outputted. Thus, projective coordinates [Xi, 
Zi]. [X2, Z2] and [X4, Z4] are inputted in a step 1302. Subsequently X1Z2 is assigned 
to Si in a step 1303. Further, X2Z1 is assigned to S2 in a step 1304. whereon Si + S2 
is assigned to B in a step 1305. When B == 0 in a step 1306 (i.e.. when decision in 
the step 1306 results in "Yes"), the processing proceeds to a step 1307. If othenvise 
(i.e., when the decision in the step 1306 results in "No"), the processing proceeds to 
a step 1308. In the step 1307, the point at infinity is outputted, and then a step 1313 
is executed. On the other hand, when the decision step 1306 results in "No". Z4B^ is 
assigned to Z3 in a step 1308. Further, (Z4)^SiS2 is assigned to S in a st e p 1309, 
Subs e au e nt l v step 1309. Subseauentlv , X4B^ is assigned to M in a step 1310 while 
M + S is assigned to X3 in a step 131 1 , whereon [X3. Z3] is outputted in a step 1312. 

Please replace the paragraph at p^ge 48, |ia6^6 -^age 49,Jme'^rwith the 



following amended paragraph: 
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Figure 14 is a flow chart for illustrating a doubling method according to the 
fourth embodiment of the invention. The processing starts at step 1401 . It is 
presumed that Q = [Xi. Zi] and b are inputted for thereby outputting 2Q = [X2. Z2] or 
the point at infinity. More specifically. [Xi, Z^] and b are inputted in a step 1402. 
When X2 == 0 orZ2 == 0 (i.e., when the decision in the step 1403 results in "Yes"), 
the processing proceeds to a step 1404. If othenA^ise (i.e., when the decision step 
1403 results in "No"), the processing proceeds to the step 1405. In the step 1404, 
the point at infinity is outputted. In the step 1405, is assigned to Z2. In the step 
1406, Xi^S is assigned to S. In the step 1407, X/ + bS is assigned to X2, which is 
then followed by a step 1408 where [X2, Z2] is outputted. Through the procedure 
described above, the addition arithmetic can be realized by executing twice the 
multiplication of mutually different variables. The process ends at step 1409. 

PleaseTeplace*^ — 

following amended paragraph: 

Figure 16 is a flow chart for illustrating an addition method according to the 
fifth embodiment of the present invention. The process starts at step 601 . It is 
assumed that projective coordinates [Xi, Zi], [X2, Z2] and X4 are inputted, whereby 
[X3, Z3] or the point at infinity is outputted. Thus, projective coordinates [Xi. Z^], [X2, 
/(P Z2] and X4 are inputted in a step 1602. In the succeeding step 1603, X1Z2 is 

assigned to Si. Further, X2Z1 is assigned to S2 in a step 1604 with Si + S2 being 
assigned to B in a step 1605. When B == 0 in a step 1606 (i.e., when decision in the 
step 1606 results in "Yes"), the processing proceeds to a step 1607. If otherwise 
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(i.e., when decision in the step 1606 results in "No), the processing proceeds to a 
step 1608. In the step 1607, the point at infinity is outputted, whereon an end step 
1613 is executed. On the other hand, unless B = 0 in the step 1606, is assigned 
to Zr^ (step 1608) . In the succeeding otop 1608 step 1609 . S1S2 is assigned to S. 
Further, {yWZ?) is assigned to M in a step 1610 while M + S is assigned to X3 in a 
step 161 1. Finally, [X3, Z3] is outputted in a step 1612, The process ends at step 
1613. Through the procedure described above, the addition arithmetic can be 
realized by executing four tinnes the multiplication of mutually different variables. 
Parenthetically, as the doubling arithmetic according to the instant embodiment of 
the invention, the doubling arithmetic described hereinbefore can be adopted. 
Additionally, the method incarnated in the instant embodiment can also find 
application not only to the arithmetic with the elliptic curve in the finite field of 
characteristic 2 but also to the arithmetic with the ellipt ic curve in the prime field. 

Please replace the paragraph at^page^3,^Hfie^4 - psrge^ 55^JiP€r6'with the 
following amended paragraph: 



The elliptic curve arithmetic unit 901 has input 902 and output 903 and 
includes a random number generation module 904 for generating a random number 
k to be outputted, as indicated by an arrow 905. The random number k generated by 
the random number generation module 904 is inputted to a projective coordinate 
transformation module 906 together with the x-coordinate Xo, the scalar value m and 
the parameter b although they are not shown in Fig. 9, to be thereby transformed to 
the projective coordinates [kXo, k], which is then assigned to [Xi, Zi]. The projective 
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coordinate [Xi, Z^] and the scalar value m are inputted to a scalar multiplication 
module 908 (arrow 907) . whereby a point given by [Xi. Zi] multiplied by m is 
determined. Thus, the x-coordinate Xm of the point as determined is outputted from 
the scalar multiplication module 908 (arrow 912) . In the scalar multiplication module 
908, [Xi, Zi] is first assigned to [X4. Z4] which may be previously stored in a memory 
incorporated, for example, in the scalar multiplication module. Further, the projective 
coordinates [Xi, Z^] are supplied to a doubling arithmetic module 913 for determining 
a double point [X2, Z2]. Subsequently, m is developed to a binary bit string. Every 
time the bit assumes "0", starting the more significant bit, [Xi, Z^] is supplied to the 
doubling arithmetic 913, whereon the double point outputted from the doubling 
arithmetic module 913 is assigned to [Xi, Zi1 (arrow 914) . Subsequently, projective 
coordinates [Xi, Zi], [X2. Z2] and [X4, Z4] are inputted to an addition arithmetic 
module 910 (arrow 909) , and the addition point outputted from the addition arithmetic 
module 910 is assigned to [X2, Z?] (arrow 911) . On the other hand, when the bit is 
"1", the projective coordinates [X2. Z2] are outputted to the doubling arithmetic 
module 913. whereon the double point outputted from the doubling arithmetic 
module 913 is assigned to [X2. Z2]. Subsequently, the projective coordinates, [Xi, 
Zi], [X2, Z2] and [X4. Z4] are inputted to the addition arithmetic module 910, and the 
addition point outputted from the addition arithmetic module 910 is assigned to [Xi, 
Zi]. Thus, there is derived the Xm-coordinate of the m-tuple point. 
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